How do I install the Torusguard Exploit Check skill?

Run npx skillmds@latest add githubmofo/torusguard-exploit-check in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Torusguard Exploit Check safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Torusguard Exploit Check?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Torusguard Exploit Check free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Torusguard Exploit Check?

githubmofo (@githubmofo) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Torusguard Exploit Check by githubmofo

Name: Torusguard Exploit Check
Author: githubmofo

File contents

TorusGuard Exploit Check — Bounded Exploitability Confirmation

Objective

Confirm whether candidate findings are practically exploitable using safe, single-step sentinel canaries without data loss or weaponized execution.

Authorization Gate Check

Before dispatching any exploitability probe:

Verify target route is explicitly authorized in .torusguard/config/scope.json.
Verify authorization TTL has not expired.
Assert probe passes .torusguard/scripts/safety_gate.py.

Bounded Probe Strategies

SQLi: Mathematical identity canary (' OR 1=1--) asserting differential response without altering data.
XSS: Inert HTML marker tag (<tg-canary-tag>) checking unescaped reflection in DOM.
IDOR: Cross-tenant GET using secondary tenant session; assert 403 vs leak.
Auth: Omit auth header on protected route; assert 401.

Execution Steps

Verify Scope: Read scope.json; assert authorized endpoint.
Select Canary: Choose matching non-destructive probe strategy.
Handle Automation Failure: If automated exploit check scripts fail, YOU must manually construct the safe HTTP request (using curl or fetch) and inspect the response.
Dispatch Probe: Send request with header X-TorusGuard-AuthID.
Classify Status: Transition finding into one of 5 canonical outcomes:
- Confirmed: Canary reflected or secondary tenant data leaked.
- Not Reproducible: Endpoint responded with 401/403 or sanitized input.
- Needs Review: Ambiguous status code or incomplete response.
- Blocked by Controls: WAF or rate limiter stopped probe.
- Out of Scope: Target endpoint is not authorized.
Record Evidence: Save trace in .torusguard/runs/<run_id>/exploit-evidence.md.

Safety Constraints

Zero destructive payloads (DROP, DELETE, UPDATE).
No denial-of-service or continuous fuzzing loops.
Redact tokens before recording traces.

Output Format

🎯 [TorusGuard] Exploitability Confirmation (AI Assisted)
- Finding ID: <Finding ID> | Target: <Route>
- Status: <Confirmed / Not Reproducible / Blocked>
- Evidence: <Response snippet or status code>
Next: Run `/torusguard harden` to formulate surgical remediation bundle.

---name: torusguard-exploit-checkdescription: Safe, non-destructive confirmation of exploitability using inert canary tokens and sentinels.---# TorusGuard Exploit Check — Bounded Exploitability Confirmation## ObjectiveConfirm whether candidate findings are practically exploitable using safe, single-step sentinel canaries without data loss or weaponized execution.---## Authorization Gate CheckBefore dispatching any exploitability probe:1. Verify target route is explicitly authorized in `.torusguard/config/scope.json`.2. Verify authorization TTL has not expired.3. Assert probe passes `.torusguard/scripts/safety_gate.py`.---## Bounded Probe Strategies- **SQLi:** Mathematical identity canary (`' OR 1=1--`) asserting differential response without altering data.- **XSS:** Inert HTML marker tag (`<tg-canary-tag>`) checking unescaped reflection in DOM.- **IDOR:** Cross-tenant GET using secondary tenant session; assert 403 vs leak.- **Auth:** Omit auth header on protected route; assert 401.---## Execution Steps1. **Verify Scope:** Read `scope.json`; assert authorized endpoint.2. **Select Canary:** Choose matching non-destructive probe strategy.3. **Handle Automation Failure:** If automated exploit check scripts fail, YOU must manually construct the safe HTTP request (using `curl` or `fetch`) and inspect the response.4. **Dispatch Probe:** Send request with header `X-TorusGuard-AuthID`.5. **Classify Status:** Transition finding into one of 5 canonical outcomes: - `Confirmed`: Canary reflected or secondary tenant data leaked. - `Not Reproducible`: Endpoint responded with 401/403 or sanitized input. - `Needs Review`: Ambiguous status code or incomplete response. - `Blocked by Controls`: WAF or rate limiter stopped probe. - `Out of Scope`: Target endpoint is not authorized.6. **Record Evidence:** Save trace in `.torusguard/runs/<run_id>/exploit-evidence.md`.---## Safety Constraints- Zero destructive payloads (`DROP`, `DELETE`, `UPDATE`).- No denial-of-service or continuous fuzzing loops.- Redact tokens before recording traces.---## Output Format```markdown🎯 [TorusGuard] Exploitability Confirmation (AI Assisted)- Finding ID: <Finding ID> | Target: <Route>- Status: <Confirmed / Not Reproducible / Blocked>- Evidence: <Response snippet or status code>Next: Run `/torusguard harden` to formulate surgical remediation bundle.```

Frequently asked questions

Torusguard Exploit Check